voyager-ionic-core 8.8.17 → 9.0.1

package/dist/cjs/index-BbqUBe2T.js

@@ -0,0 +1,429 @@
+/*!
+ * (C) Ionic http://ionicframework.com - MIT License
+ */
+'use strict';
+
+var index = require('./index-DXoo08JC.js');
+
+/**
+ * Sanitize an untrusted HTML string.
+ *
+ * Parses the string into a detached DOM, removes blocked tags, strips
+ * attributes outside the narrow `domStringAllowedAttributes` list (refer
+ * `sanitizeElement`), and scrubs script-scheme URLs. Returns the sanitized
+ * HTML string.
+ *
+ * Use this when you have an HTML string from an unknown source and need to
+ * render it via `innerHTML`. Use `sanitizeDOMTree` instead when you already
+ * have a DOM tree and want to sanitize it in place without a string round
+ * trip. The two apply the same dangerous-vector scrubbing but different
+ * attribute allowlists: this path stays narrow so existing consumers
+ * (toast, loading, alert message, etc.) are unaffected, while
+ * `sanitizeDOMTree` uses the wider rich-content allowlist.
+ *
+ * @param untrustedString - The HTML string to sanitize. Pass an
+ * `IonicSafeString` to bypass sanitization, or `undefined` to short-circuit.
+ * @returns The sanitized HTML string, or `undefined` if the input was
+ * `undefined`. Returns `''` if sanitization fails or the input contains
+ * an inline `onload=` handler.
+ */
+const sanitizeDOMString = (untrustedString) => {
+    try {
+        if (untrustedString instanceof IonicSafeString) {
+            return untrustedString.value;
+        }
+        if (!isSanitizerEnabled() || typeof untrustedString !== 'string' || untrustedString === '') {
+            return untrustedString;
+        }
+        /**
+         * onload is fired when appending to a document
+         * fragment in Chrome. If a string
+         * contains onload then we should not
+         * attempt to add this to the fragment.
+         */
+        if (untrustedString.includes('onload=')) {
+            return '';
+        }
+        /**
+         * Create a document fragment
+         * separate from the main DOM,
+         * create a div to do our work in
+         */
+        const documentFragment = document.createDocumentFragment();
+        const workingDiv = document.createElement('div');
+        documentFragment.appendChild(workingDiv);
+        workingDiv.innerHTML = untrustedString;
+        /**
+         * Remove any elements
+         * that are blocked
+         */
+        blockedTags.forEach((blockedTag) => {
+            const getElementsToRemove = documentFragment.querySelectorAll(blockedTag);
+            for (let elementIndex = getElementsToRemove.length - 1; elementIndex >= 0; elementIndex--) {
+                const element = getElementsToRemove[elementIndex];
+                if (element.parentNode) {
+                    element.parentNode.removeChild(element);
+                }
+                else {
+                    documentFragment.removeChild(element);
+                }
+                /**
+                 * We still need to sanitize
+                 * the children of this element
+                 * as they are left behind
+                 */
+                const childElements = getElementChildren(element);
+                /* eslint-disable-next-line */
+                for (let childIndex = 0; childIndex < childElements.length; childIndex++) {
+                    sanitizeElement(childElements[childIndex], domStringAllowedAttributes);
+                }
+            }
+        });
+        /**
+         * Go through remaining elements and remove
+         * non-allowed attribs
+         */
+        // IE does not support .children on document fragments, only .childNodes
+        const dfChildren = getElementChildren(documentFragment);
+        /* eslint-disable-next-line */
+        for (let childIndex = 0; childIndex < dfChildren.length; childIndex++) {
+            sanitizeElement(dfChildren[childIndex], domStringAllowedAttributes);
+        }
+        // Append document fragment to div
+        const fragmentDiv = document.createElement('div');
+        fragmentDiv.appendChild(documentFragment);
+        // First child is always the div we did our work in
+        const getInnerDiv = fragmentDiv.querySelector('div');
+        return getInnerDiv !== null ? getInnerDiv.innerHTML : fragmentDiv.innerHTML;
+    }
+    catch (err) {
+        index.printIonError('sanitizeDOMString', err);
+        return '';
+    }
+};
+/**
+ * Sanitize an entire trusted DOM tree in place.
+ *
+ * Removes blocked tags (`script`, `iframe`, etc.) from the subtree and
+ * then sanitizes attributes on every remaining element using the wider
+ * `richContentAllowedAttributes` allowlist (refer `sanitizeElement`).
+ * Component presentational attributes (`size`, `color`, `shape`, inline
+ * SVG, `aria-*`, `data-*`) are preserved; `style`, event handlers (`on*`),
+ * form/navigation-hijack attributes, script-scheme URLs, and non-image
+ * `data:` URLs are stripped.
+ *
+ * Use this when you have a DOM tree the developer controls (e.g.
+ * cloned slot content from a component) and you need to render it
+ * elsewhere safely.
+ *
+ * @param root - The root element whose subtree will be sanitized in
+ * place. No-op when the sanitizer is disabled via `Ionic.config`.
+ */
+const sanitizeDOMTree = (root) => {
+    if (!isSanitizerEnabled()) {
+        return;
+    }
+    blockedTags.forEach((tag) => {
+        const matches = root.querySelectorAll(tag);
+        for (let i = matches.length - 1; i >= 0; i--) {
+            matches[i].remove();
+        }
+    });
+    sanitizeElement(root, richContentAllowedAttributes, richContentAllowedAttributePrefixes);
+};
+/**
+ * Clean up current element based on allowed attributes
+ * and then recursively dig down into any child elements to
+ * clean those up as well
+ */
+// TODO(FW-2832): type (using Element triggers other type errors as well)
+const sanitizeElement = (element, allowedAttributes, allowedAttributePrefixes = []) => {
+    // IE uses childNodes, so ignore nodes that are not elements
+    if (element.nodeType && element.nodeType !== 1) {
+        return;
+    }
+    /**
+     * If attributes is not a NamedNodeMap
+     * then we should remove the element entirely.
+     * This helps avoid DOM Clobbering attacks where
+     * attributes is overridden.
+     */
+    if (typeof NamedNodeMap !== 'undefined' && !(element.attributes instanceof NamedNodeMap)) {
+        element.remove();
+        return;
+    }
+    /**
+     * Always strip `style` (CSS injection, `background:url()` beaconing, UI
+     * spoofing). It is never on the allowlist, but it is removed explicitly
+     * here because some engines (e.g. jsdom) don't enumerate the CSSOM-backed
+     * `style` attribute in `element.attributes`, which would let the loop
+     * below skip over it.
+     */
+    element.removeAttribute('style');
+    for (let i = element.attributes.length - 1; i >= 0; i--) {
+        const attribute = element.attributes.item(i);
+        const attributeName = attribute.name;
+        const lowerName = attributeName.toLowerCase();
+        /**
+         * Remove any attribute that is not on the allowlist. This drops event
+         * handlers (`on*`), `style`, the form/navigation-hijack attributes
+         * (`formaction`, `action`, `target`), namespaced attributes like
+         * `xlink:href`, and anything else not explicitly known to be safe.
+         */
+        if (!isAttributeAllowed(lowerName, allowedAttributes, allowedAttributePrefixes)) {
+            element.removeAttribute(attributeName);
+            continue;
+        }
+        // clean up any allowed attribs
+        // that attempt to do any JS funny-business
+        const attributeValue = attribute.value;
+        if (attributeValue == null) {
+            continue;
+        }
+        /**
+         * Scrub dangerous schemes from the value. The value is normalized first
+         * (whitespace and ASCII control characters removed) so entity-obfuscated
+         * payloads such as `java&#9;script:`, which the parser decodes to
+         * `java\tscript:`, are still caught. Normalizing the value also covers
+         * namespaced attributes, where the previous `element[attributeName]`
+         * property reflection returned `undefined` and let them slip through.
+         */
+        const normalizedValue = attributeValue.replace(controlCharactersAndWhitespace, '').toLowerCase();
+        // Script schemes are never allowed, on any attribute.
+        if (normalizedValue.includes('javascript:') || normalizedValue.includes('vbscript:')) {
+            element.removeAttribute(attributeName);
+            continue;
+        }
+        /**
+         * For URL-bearing attributes, allow `data:` URIs only for raster
+         * images. Document-bearing types (`text/html`, `image/svg+xml`,
+         * `application/*`, etc.) can carry markup or script when navigated to
+         * or rendered, so they are stripped, while safe image types are kept so
+         * inline images keep working.
+         */
+        if (urlAttributes.includes(lowerName) &&
+            normalizedValue.startsWith('data:') &&
+            !safeDataImageUri.test(normalizedValue)) {
+            element.removeAttribute(attributeName);
+        }
+    }
+    /**
+     * Sanitize any nested children
+     */
+    const childElements = getElementChildren(element);
+    /* eslint-disable-next-line */
+    for (let i = 0; i < childElements.length; i++) {
+        sanitizeElement(childElements[i], allowedAttributes, allowedAttributePrefixes);
+    }
+};
+/**
+ * IE doesn't always support .children
+ * so we revert to .childNodes instead
+ */
+// TODO(FW-2832): type
+const getElementChildren = (el) => {
+    return el.children != null ? el.children : el.childNodes;
+};
+const isSanitizerEnabled = () => {
+    const win = window;
+    const config = win?.Ionic?.config;
+    if (config) {
+        if (config.get) {
+            return config.get('sanitizerEnabled', true);
+        }
+        else {
+            return config.sanitizerEnabled === true || config.sanitizerEnabled === undefined;
+        }
+    }
+    return true;
+};
+/**
+ * Mirror known custom-element DOM properties onto attributes so they
+ * survive `cloneNode`. Call this on a DOM subtree before cloning it for
+ * rendering elsewhere (e.g. cloning slotted option content into an
+ * overlay).
+ *
+ * Only sets the attribute when the property holds a non-empty string
+ * and the attribute isn't already present, so existing attributes
+ * take precedence.
+ *
+ * @param root - The root element whose subtree (and itself) will be
+ * inspected.
+ */
+const reflectPropertiesToAttributes = (root) => {
+    const candidates = [];
+    if (root.tagName in elementPropsToReflect) {
+        candidates.push(root);
+    }
+    for (const tagName of Object.keys(elementPropsToReflect)) {
+        candidates.push(...Array.from(root.querySelectorAll(tagName.toLowerCase())));
+    }
+    for (const el of candidates) {
+        if (!(el.tagName in elementPropsToReflect)) {
+            continue;
+        }
+        const props = elementPropsToReflect[el.tagName];
+        for (const prop of props) {
+            const value = el[prop];
+            if (typeof value === 'string' && value.length > 0 && !el.hasAttribute(prop)) {
+                el.setAttribute(prop, value);
+            }
+        }
+    }
+};
+/**
+ * Attribute allowlist for `sanitizeDOMString`. Intentionally narrow: this
+ * path sanitizes developer HTML strings rendered via `innerHTML` by
+ * `ion-toast`, `ion-loading`, the `ion-alert` message,
+ * `ion-refresher-content`, and `ion-infinite-scroll-content`, so the list
+ * is kept to the minimum those have always needed. Broadening it here would
+ * change sanitization output for all of those consumers, so the wider
+ * rich-content allowlist below is deliberately scoped to `sanitizeDOMTree`
+ * instead.
+ */
+const domStringAllowedAttributes = ['class', 'id', 'href', 'src', 'name', 'slot'];
+/**
+ * Attribute allowlist for `sanitizeDOMTree` (the select rich-content path).
+ * Covers global HTML attributes, the Ionic component presentational props
+ * that cloned rich content (e.g. `ion-select-option` markup) relies on, and
+ * the inert SVG presentation attributes used by inline icons.
+ *
+ * `aria-*` and `data-*` are allowed separately by prefix (refer
+ * `richContentAllowedAttributePrefixes`) since they are inert and not worth
+ * enumerating. URL-bearing names (`href`, `src`) are allowed here, but
+ * their values are still scrubbed for script schemes in `sanitizeElement`.
+ *
+ * Notably absent: `style`, event handlers (`on*`), and the
+ * form/navigation-hijack attributes (`formaction`, `action`, `target`),
+ * which are therefore stripped.
+ */
+const richContentAllowedAttributes = [
+    // Global / structural
+    'class',
+    'id',
+    'slot',
+    'name',
+    'title',
+    'alt',
+    'lang',
+    'dir',
+    'role',
+    'type',
+    'value',
+    'disabled',
+    'width',
+    'height',
+    'href',
+    'src',
+    // Ionic component presentational props
+    'color',
+    'size',
+    'shape',
+    'fill',
+    'expand',
+    'mode',
+    'theme',
+    'icon',
+    'label',
+    'label-placement',
+    'justify',
+    'inset',
+    'lines',
+    'ios',
+    'md',
+    // SVG presentation attributes (compared lowercased, e.g. `viewBox`)
+    'xmlns',
+    'viewbox',
+    'preserveaspectratio',
+    'stroke',
+    'stroke-width',
+    'stroke-linecap',
+    'stroke-linejoin',
+    'stroke-opacity',
+    'stroke-dasharray',
+    'fill-rule',
+    'fill-opacity',
+    'clip-rule',
+    'd',
+    'points',
+    'cx',
+    'cy',
+    'r',
+    'rx',
+    'ry',
+    'x',
+    'y',
+    'x1',
+    'y1',
+    'x2',
+    'y2',
+    'transform',
+    'opacity',
+];
+/**
+ * Attribute-name prefixes that are always safe to keep in the rich-content
+ * path. `aria-*` and `data-*` attributes cannot execute script or load
+ * resources, so they are allowed wholesale rather than enumerated by name.
+ */
+const richContentAllowedAttributePrefixes = ['aria-', 'data-'];
+/**
+ * Whether an attribute name (already lowercased) is safe to keep, by exact
+ * match or by an allowed prefix.
+ */
+const isAttributeAllowed = (lowerName, allowedAttributes, allowedAttributePrefixes) => {
+    if (allowedAttributes.includes(lowerName)) {
+        return true;
+    }
+    return allowedAttributePrefixes.some((prefix) => lowerName.startsWith(prefix));
+};
+/**
+ * Matches ASCII control characters and whitespace (including the
+ * non-breaking space). Used to normalize attribute values before matching
+ * a URL scheme so entity-obfuscated payloads such as `java&#9;script:`
+ * (decoded by the parser to `java\tscript:`) can't smuggle a scheme past
+ * the check.
+ */
+// eslint-disable-next-line no-control-regex -- matching control characters is the point
+const controlCharactersAndWhitespace = /[\u0000-\u0020\u007f-\u00a0]/g;
+/**
+ * Attributes whose values are URLs. Their values are scheme-checked in
+ * `sanitizeElement` (e.g. `data:` filtering) beyond the script-scheme scrub
+ * applied to every attribute.
+ */
+const urlAttributes = ['href', 'src'];
+/**
+ * Matches a `data:` URI for a raster image type that cannot carry script.
+ * `image/svg+xml` is deliberately excluded (SVG can execute script), as are
+ * document types like `text/html` and `application/*`. The value is already
+ * lowercased and whitespace-stripped before this is tested.
+ */
+const safeDataImageUri = /^data:image\/(?:png|jpe?g|gif|webp|bmp|avif|x-icon|vnd\.microsoft\.icon)[;,]/;
+/**
+ * Tags removed entirely (with their subtree) before attribute sanitization.
+ * Exported so tests can assert the set without hardcoding it.
+ */
+const blockedTags = ['script', 'style', 'iframe', 'meta', 'link', 'object', 'embed', 'base'];
+/**
+ * Properties on custom elements that frameworks (Vue, Angular) often
+ * set as DOM properties rather than attributes. `cloneNode` only copies
+ * attributes, so these values are lost when slotted content is cloned
+ * into an overlay. For each known custom element, we mirror the listed
+ * properties onto attributes so the cloned copy still has the data it
+ * needs to render.
+ *
+ * Keyed by uppercased tagName so the lookup matches `Element.tagName`.
+ */
+const elementPropsToReflect = {
+    'ION-ICON': ['icon', 'name', 'src', 'ios', 'md'],
+};
+class IonicSafeString {
+    constructor(value) {
+        this.value = value;
+    }
+}
+
+exports.IonicSafeString = IonicSafeString;
+exports.blockedTags = blockedTags;
+exports.reflectPropertiesToAttributes = reflectPropertiesToAttributes;
+exports.sanitizeDOMString = sanitizeDOMString;
+exports.sanitizeDOMTree = sanitizeDOMTree;

package/dist/cjs/{index-D81eLYUM.js → index-C74Q3t6a.js}

@@ -4,8 +4,9 @@
 'use strict';
 
 var index = require('./index-DkNv4J_i.js');
-var helpers = require('./helpers-Cv23MFHM.js');
-require('./index-Ct7gcRif.js');
+var helpers = require('./helpers-7wzdhdeg.js');
+require('./index-DXoo08JC.js');
+require('./dir-zwDPRE5K.js');
 
 const startTapClick = (config) => {
     if (index.doc === undefined) {

package/dist/cjs/{index-BERfRao3.js → index-CQfEIyLK.js}

@@ -3,8 +3,8 @@
  */
 'use strict';
 
-var index = require('./index-Ct7gcRif.js');
-var helpers = require('./helpers-Cv23MFHM.js');
+var index = require('./index-DXoo08JC.js');
+var helpers = require('./helpers-7wzdhdeg.js');
 
 const LIFECYCLE_WILL_ENTER = 'ionViewWillEnter';
 const LIFECYCLE_DID_ENTER = 'ionViewDidEnter';
@@ -45,7 +45,7 @@ const createFocusController = () => {
          */
         if (focusManagerEnabled) {
             const activeEl = document.activeElement;
-            if (activeEl !== null && (referenceEl === null || referenceEl === void 0 ? void 0 : referenceEl.contains(activeEl))) {
+            if (activeEl !== null && referenceEl?.contains(activeEl)) {
                 activeEl.setAttribute(LAST_FOCUS, 'true');
             }
         }
@@ -120,8 +120,8 @@ const createFocusController = () => {
 };
 const LAST_FOCUS = 'ion-last-focus';
 
-const iosTransitionAnimation = () => Promise.resolve().then(function () { return require('./ios.transition-BOSWOaiK.js'); });
-const mdTransitionAnimation = () => Promise.resolve().then(function () { return require('./md.transition-B8-wBZqt.js'); });
+const iosTransitionAnimation = () => Promise.resolve().then(function () { return require('./ios.transition-DYGiD6gM.js'); });
+const mdTransitionAnimation = () => Promise.resolve().then(function () { return require('./md.transition-CrSkaoz6.js'); });
 const focusController = createFocusController();
 // TODO(FW-2832): types
 /**

package/dist/cjs/{index-aC4x3Fk3.js → index-DFNrCX7M.js}

@@ -4,11 +4,11 @@
 'use strict';
 
 var index = require('./index-DkNv4J_i.js');
-var hardwareBackButton = require('./hardware-back-button-iUuF_76h.js');
-var index$1 = require('./index-Ct7gcRif.js');
-var helpers = require('./helpers-Cv23MFHM.js');
-var ionicGlobal = require('./ionic-global-B-cA6LkY.js');
-var animation = require('./animation-BJq0kcy2.js');
+var hardwareBackButton = require('./hardware-back-button-Bu4Dzw8l.js');
+var index$1 = require('./index-DXoo08JC.js');
+var helpers = require('./helpers-7wzdhdeg.js');
+var ionicGlobal = require('./ionic-global-CYJNT-2P.js');
+var animation = require('./animation-Kd1N7WTN.js');
 
 /**
  * baseAnimation
@@ -139,7 +139,6 @@ const createMenuController = () => {
     const isOpen = async (menu) => {
         if (menu != null) {
             const menuEl = await get(menu);
-            // eslint-disable-next-line @typescript-eslint/prefer-optional-chain
             return menuEl !== undefined && menuEl.isOpen();
         }
         else {
@@ -275,7 +274,7 @@ const createMenuController = () => {
     registerAnimation('reveal', menuRevealAnimation);
     registerAnimation('push', menuPushAnimation);
     registerAnimation('overlay', menuOverlayAnimation);
-    index.doc === null || index.doc === void 0 ? void 0 : index.doc.addEventListener('ionBackButton', (ev) => {
+    index.doc?.addEventListener('ionBackButton', (ev) => {
         const openMenu = _getOpenSync();
         if (openMenu) {
             ev.detail.register(hardwareBackButton.MENU_BACK_BUTTON_PRIORITY, () => {

package/dist/cjs/{index-CAvQ7Tka.js → index-DRPqwSvU.js}

@@ -3,18 +3,14 @@
  */
 'use strict';
 
-var gestureController = require('./gesture-controller-dtqlP_q4.js');
+var gestureController = require('./gesture-controller-CeJslptU.js');
 
 const addEventListener = (el, // TODO(FW-2832): type
 eventName, callback, opts) => {
-    // use event listener options when supported
-    // otherwise it's just a boolean for the "capture" arg
-    const listenerOpts = supportsPassive(el)
-        ? {
-            capture: false,
-            passive: !!opts.passive,
-        }
-        : false;
+    const listenerOpts = {
+        capture: false,
+        passive: !!opts.passive,
+    };
     let add;
     let remove;
     if (el['__zone_symbol__addEventListener']) {
@@ -30,25 +26,6 @@ eventName, callback, opts) => {
         el[remove](eventName, callback, listenerOpts);
     };
 };
-const supportsPassive = (node) => {
-    if (_sPassive === undefined) {
-        try {
-            const opts = Object.defineProperty({}, 'passive', {
-                get: () => {
-                    _sPassive = true;
-                },
-            });
-            node.addEventListener('optsTest', () => {
-                return;
-            }, opts);
-        }
-        catch (e) {
-            _sPassive = false;
-        }
-    }
-    return !!_sPassive;
-};
-let _sPassive;
 
 const MOUSE_WAIT = 2000;
 // TODO(FW-2832): types
@@ -225,7 +202,13 @@ const createGesture = (config) => {
     let hasStartedPan = false;
     let hasFiredStart = true;
     let isMoveQueued = false;
-    const finalConfig = Object.assign({ disableScroll: false, direction: 'x', gesturePriority: 0, passive: true, maxAngle: 40, threshold: 10 }, config);
+    const finalConfig = {
+        direction: 'x',
+        passive: true,
+        maxAngle: 40,
+        threshold: 10,
+        ...config,
+    };
     const canStart = finalConfig.canStart;
     const onWillStart = finalConfig.onWillStart;
     const onStart = finalConfig.onStart;
@@ -340,7 +323,7 @@ const createGesture = (config) => {
     const blurActiveElement = () => {
         if (typeof document !== 'undefined') {
             const activeElement = document.activeElement;
-            if (activeElement === null || activeElement === void 0 ? void 0 : activeElement.blur) {
+            if (activeElement?.blur) {
                 activeElement.blur();
             }
         }